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Abstract — The introduction of new technologies and 
concepts of operation in the air transportation system is 
not possible, unless they can be proven not to adversely 
affect the system operation under not only nominal, but 
also degraded conditions. In extreme scenarios, degraded 
operations due to partial or complete technological failures 
should never endanger system safety. Many past system 
evolutions, whether ground-based or airborne, have been 
based on trial-and-error, and system safety was addressed 
only after a specific event yielded dramatic or near- 
dramatic consequences. Future system evolutions, however, 
must leverage available computation, prior knowledge and 
abstract reasoning to anticipate all possible system degra- 
dations and prove that such degradations are graceful and 
safe. This paper is concerned with the graceful degradation 
of high-density, structured arrival traffic against partial 
or complete surveillance failures. It is shown that for 
equal performance requirements, some traffic configura- 
tions might be easier to handle than others, thereby offering 
a quantitative perspective on these traffic configurations' 
ability to "gracefully degrade". To support our work, we 
also introduce a new conflict resolution algorithm, aimed 
at solving conflicts involving many aircraft when aircraft 
position information is in the process of degrading. 

I. Introduction 

Air Traffic Management (ATM) reHes on several lay- 
ers of technology supporting three essential functions: 
Communication, Navigation and Surveillance (CNS). 
Advances of the CNS technology base can directly lead 
to improved air traffic management operations. And 
indeed, the air traffic management system is left with 
no choice but to leverage the concurrent advent of digi- 
tal communication technology, satellite-based navigation 
and overall improvements of available instrumentation 
to adjust its ability to handle a fast-growing traffic 
demand. The resulting Next Generation air transportation 
systems is described in detail by the Joint Planning and 
Development Office [1] for US operations, and by the 
SESAR Consortium [2], [3] for European operations. 

For example, one of the cornerstones of expanded 
operations is ADS-B, a navigation and surveillance 
concept based on the GPS satellite positioning system 
which offers the potential for giving pilots more flight 
autonomy during the en-route flight phase and enabling 
higher and more flexible traffic densities in terminal 
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areas. One of the main benefits of ADS-B is to improve 
navigation precision by providing an accurate position 
fix. Such technology also enables so-called trajectory- 
based operations (TBOs), and strategic traffic separation 
management using the concept of 4-dimensional trajec- 
tories (4DTs), whereby an aircraft is able to forecast 
and broadcast its intended trajectory well before its 
execution. 

However, the obligation for the ATM system to main- 
tain very high reliability and safety levels implies that 
such new system technologies can be implemented only 
if they lead to a system with equal or better safety 
characteristics than currently demonstrated. While sys- 
tem safety includes the ability for the system to operate 
well under nominal conditions, it is also concerned with 
off-nominal system behaviors, whereby operations are 
expected to still remain accident-free for all known 
failure modes of the system. Failures may affect several 
parts of the ATM infrastructure: 

• ATM computational infrastructure: Computers 
and communication systems (both ground-based 
and airborne) form the backbone of the air trans- 
portation system information infrastructure. Com- 
puters are not exempt from such failures, whether 
the failures involve hardware (motherboard and 
wiring) or software (incomplete functional require- 
ments or erroneous software implementation). 

• Communications: A communication mishap can 
lead to severe consequences. Most lately, on 
September 25^^, 2007, a communication failure 
at Memphis' Air Route Traffic Control Center 
(ARTCC) shut down many phone lines, radio com- 
munications and radar coverage, completely inca- 
pacitating operations for a period of two hours, and 
despite the presence of about 200 aircraft in the 
center. 

• Surveillance: Computer or radar failures can cause 
surveillance failures. For instance, in December 
2000, Miami International airport was subject to 
repeated radar failures when erroneous flight in- 
formation data appeared on the controllers' screen. 
During one such mishap, about 125 flights were 
rerouted, affecting traffic all over the US. 

• Operations: For current operation degraded modes, 
there exist backup procedures described by ICAO in 
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[4]. Also, issues in closely- spaced parallel runway 
operations is the object of several papers [5], [6]. 
An analysis of current en route air traffic control 
usage during special situations can be found in [7] . 
Operation failures can lead to accidents such as the 
2002 crash over Germany between a Russian pas- 
senger jet and a cargo plane. Contradictory orders 
provided by the Traffic Collision Avoidance System 
(TCAS) and the controller lead to a collision. 

• Vehicles: An intruder can enter the airspace and 
consequently, jeopardize the safety of surrounding 
traffic. A private plane can unintentionally get too 
close to a restricted airspace such as the vicinity 
of major airports. If a VFR (Visual Flight Rules) 
aircraft gets in the landing path of IFR (Instrument 
Flight Rules) flights, this generates an abnormal 
situation to be solved by the controller. 

• Airport closure: An airport or part of it can 
be closed, e.g for weather conditions. The traffic 
needs to be reorganized and rerouted towards other 
airports. For instance, Bangor International Airport 
is often a diversion destination when freezing rain, 
snow and fog close Boston, New York or other 
major Northeast metropolitan centers. 

In the past, such failure modes and how to recover 
from them have been identified on an ad hoc basis, 
whereby accidents have triggered extensive studies and 
redesigns of the air traffic management operations. Ex- 
tensive experience about incidents by air traffic con- 
trollers has progressively led them to always address 
"what if" questions during routine operations, leading 
them to safe operations. This system comes complete 
with degraded operation and recovery procedures, such 
as those described in [4]. One example of such fault- 
tolerant, or fail-safe procedure concerns departure oper- 
ations: A safe, collision-free path is completely specified 
to the aircraft prior to take-off, in such a way that the 
aircraft may follow this path safely even in the case of 
complete communication failure during take-off. 

ADS-B, digital communication technology and ad- 
vanced automation will enhance higher density airborne 
operations in the proximity of busy airports, en-route 
or terminal airspace operations with flexible routes, 
or cockpit-centric, decentralized conflict management. 
Those future evolutions of the system will need to be 
proven fully safe prior to their introduction within the 
operational landscape. All failure modes will need to be 
identified and shown to be handled safely prior to the 
new procedures implementation. 

Within this paper, the process by which the current 
or future system keeps operating safely despite degrada- 
tion of the sustaining CNS infrastructure will be called 
"Graceful Degradation". The term "Graceful Degrada- 
tion" finds its origins in complex computer systems [8]. 



However, it can be immediately extended to overall 
systems such as the National Airspace System (NAS), 
which include both physical assets (airplanes) and com- 
plex information infrastructures. The examination of 
concepts of operation such as NextGen in the US [1] and 
SESAR [2], [3] in Europe reveals that system safety and 
graceful degradation are considered open research issues 
for most future operations. Tables [T] and [2] present some 
of the Research and Development topics for SESAR and 
NextGen, respectively. In many regards, the works that 
most closely relate to the present paper are those devoted 
to traffic and airspace complexity [9], [10], [11], [12], 
[13], [14]. Indeed, these also aim at evaluating, in a broad 
sense, the resilience of ongoing controlled traffic against 
off-nominal events. 



No 


Research topic 


15 


Study of the following automation topics: Automated 
separation tools and safety, impact of automation on ca- 
pacity and impact of loss of situation awareness and tools 
to manage exceptions associated with loss of situation 
awareness. 


16 


Evaluation or ground based de-conniction automation 
support tools with particular focus on how to ensure 
feasible solutions with a minimum of constraints on the 
users trajectory. 


41 


Evaluation of terminal route structure design involving 
alternative arrival techniques with multiple or single 
merging points. 


42 


Evaluation of Time Based Separation (TBS) on merging 
points focussing on accuracy requirements and benefits. 


49 


Study on dynamic risk modelling and management tech- 
niques for on-line measurement of safety risk. Study on 
the assessment of the overall safety of the CONOPS. 
For now, it is not obvious that the concepts ideas all 
together are safe in principal (as stated e.g. in Episode 
3 objectives). 


51 


Model complex scenarios of new trajectory based ar- 
rival/departure techniques plus existing SID/STAR and 
also with the SID/STAR from nearby airports plus transit 
traffic 


54 


Study controller acceptability of ASAS Spacing versus 
ASAS Separation during the organization of streams of 
traffic 


62 


Development, evaluation and agreement on separation 
minima for each separation method included in the 
concept 


64 


The new separation modes described at least Dynamic 
Route Allocation, 4D Contracts and ASAS-Self Separa- 
tion in mixed mode environment shall be assessed with 
regard to maturity and potential performance: New sep- 
aration modes shall be assessed with regard to maturity 
and potential performance: The robustness and stability 
of the various methods in the face of unexpected events 
(even of small magnitude) is to be investigated. 


80 


Elaboration of high density separation concepts and asso- 
ciated airspace issues in terms of detail procedures which 
should be then validated with a focus on feasibility. 



TABLE 1: SESAR R&D topics [3] 



In this paper, we are interested in analyzing the con- 
ditions for the graceful degradation of high-density traf- 
fic when the positioning system substantially degrades. 
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The motivation behind our work is the widespread 
and growing implementation of GPS-based ADS-B as 
a replacement for other, conventional navigation and 
surveillance mechanisms such as secondary radar and 
beacon-based positioning systems. Such development 
offers the potential for enabling higher traffic densities in 
the vicinity of large and busy airports, enabling "super- 
density operations"[l]. For that purpose, the remainder 
of this paper is organized as follows: First, we state 
the graceful degradation problem in the context of high 
traffic densities and failing navigation systems. Then, 
an algorithm of avoidance under uncertainties is used 
to compare the ability for Miles In Trail and Free 
flight configurations to manage a loss of accuracy in 
the positioning system. The avoidance process under 
uncertainties is analyzed. The algorithm is presented in 
appendix. 

II. Graceful degradation of surveillance 

AND NAVIGATION SYSTEMS 

This paper focuses on the impact of surveillance and 
navigation system degradation on aircraft separation re- 
quirements. Indeed, the primary mission of the air traffic 
control system is to ensure safe aircraft separation under 
all regular and degraded circumstances. Conventional 
surveillance include radar-based technology, such as pri- 
mary and secondary radars, and ground-based beacons. 
New, higher-resolution surveillance systems are enabled 
by satellite-based positioning systems. Such technologies 
may enable reduced horizontal separation minima and 
therefore higher airborne aircraft densities. 

We may then formulate the following questions: 

1) Analysis: Graceful degradation sensitivity. Con- 
sider a given air traffic situation ( consisting of a 
number of aircraft with given positions, velocities 
and headings), what is the ''sensitivity" of this 
situation relative to a sudden degradation of the 
surveillance system? 

2) Design: Graceful degradation-compatible guid- 
ance. Consider a set of aircraft with given origins 
and destinations. Find a sequence of aircraft head- 
ings such that the graceful degradation sensitivity 
of the overall traffic of interest remains below a 
given threshold. 

In this paper, we will be concerned with the analysis 
question, leaving the design question for further research. 
The principle that will drive our analysis can be sketched 
as follows: Considering a set of aircraft operating under 
a "high performance" surveillance system, we analyze 
whether safety can be maintained despite a failure of 
the surveillance system. Assuming that failures of the 
surveillance system consist of a partial loss of vehicle 
coverage, we will be interested in what maneuvers will 
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Fig. 1: Super-Density operations [1] 



allow aircraft to remain provably separated. Indeed, 
partial or complete loss of aircraft position coverage 
results in growing uncertainty about aircraft positions, 
in such a way that aircraft initially close to each other 
may not be distinguishable from each other shortly 
after the failure, unless they maneuver to augment their 
physical separation. Thus, underpinning our analysis of 
the the ability for a particular airborne configuration to 
gracefully degrade, we find the necessity to design pro- 
cedures enabling traffic to maintain provable separation 
under degraded conditions. In this paper, such procedure 
will consist of a novel aircraft conflict management 
algorithm. 

Considering a planar traffic environment for simplic- 
ity, we introduce the following definitions: 

1) Nominal operations: Nominal operations consist 
of all allowable aircraft operations when aircraft 
position accuracy is high. The nominal minimum 
aircraft separation distance ( expressed in nautical 
miles) will be denoted tq . 

2) Degraded operations: Degraded operation con- 
sist of all allowable aircraft operations when 
aircraft position accuracy is low. The degraded 
minimum aircraft separation distance (expressed 
in nautical miles) will be denoted Vf, with Vf > tq. 

Radar precision is one of the main reason for deciding 
on specific aircraft separation standards. The uncertainty 
in the position seen by the controllers leads to a sepa- 
ration requirement that can be interpreted as a circle of 
avoidance around each aircraft. The circle of avoidance 
corresponds to the area around the aircraft where no 
other aircraft is allowed. Its radius is generally 2.5 NM 
for en-route and 1.5 NM for approach. This separation 
distance ensures safety if the position of the aircraft is 
relatively well known and regularly updated. Accurate 
positioning systems such as ADS-B will probably enable 
a reduction in allowable spacing distance [15]. If a failure 
happens, the system works in degraded mode, resulting 
in an increase in uncertainties on the aircraft position 
observed by the controller. As aircraft's position are 
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known less accurately, the resulting radius of avoidance 
must be increased. The growth of the avoidance cir- 
cle is limited by backup positioning system (Primary 
Surveillance Radars, radio...) that enable controllers to 
get reports on aircraft's position. For instance, in the case 
of the breakdown of a radar, separation distances must 
be increased to procedural separation standards [4]. The 
position of the aircraft will be reported by the pilot to 
the controller by radio with a low update rate. Between 
updates, the position of the aircraft is not known and the 
uncertainty on it increases with time. 

In the remainder of this paper, we will assume that a 
position system failure occurs at time t = 0. Prior to that 
time, nominal aircraft position accuracy will translate 
into a circle of avoidance with radius tq. 




Fig. 2: Track of a growing circle of avoidance 



For t > 0, we propose a time- varying model of 
position uncertainties, whereby the radius of avoidance 
grows from ro to r/ > ro over a given period of time. 
Figure |2] presents the track of a growing circle of avoid- 
ance. For instance, ro can be the radius of avoidance 
provided by an ADS-B positioning system, while r/ can 
be the one provided by a Primary Surveillance Radar 
(PSR). In the event of an ADS-B failure, the transition 
from ro and r/ must be eventless, in the sense that the 
transition should not jeopardize the safety of the overall 
traffic. 

For each aircraft i, we will assume a constant growth 
rate r^, such that r{t) = ro + Vit. Such a model 
approximately captures the growing, but bounded un- 
certainty on aircraft position once the navigation system 
has failed. Such uncertainty might reflect the effect of 
uncertainties on the aircraft heading (denoted AO) and on 
the aircraft velocity (denoted AVi). Figure |3] shows the 
uncertainty on the trajectory. A simple way to connect 
these uncertainties to the growing avoidance radius is to 
write, for example, 

Ti = m8ix{Vi sin A(9, AVi}. (1) 

Note this is a conservative approximation. 

From these considerations, we see it will not be diffi- 
cult to create aircraft configurations which are conflict- 
free, yet will rapidly generate conflicts in case of 
positioning system degradation. Thus, the ability for 
such configurations to gracefully degrade will rely on 
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Fig. 3: Uncertainty on the trajectory 

our ability to develop a conflict resolution strategy for 
growing aircraft position uncertainties. Figure |4] shows 
the difference between a classical conflict avoidance 
problem and the problem we are solving. In the classical 
avoidance problem, the radius of avoidance is constant. 
In our problem, the growing radius of avoidance makes 
the formulation and resolution more complicated as it is 
time dependent. 




(a) Classical conflict avoid- (b) Growing uncertainties conflict 
ance avoidance 



Fig. 4: Conflict avoidance problems comparison 

When several aircraft are present within a given 
airspace sector, the conflict resolution problem under 
degrading position uncertainty becomes much more 
complex. An approach using mathematical programming 
based on a formulation originally presented in [16] is 
introduced in Appendix. The problem is formulated as 
a Mixed Integer Linear Program (MILP) and is imple- 
mented using the AMPL/CPLEX linear programming 
tool suite [17], [18]. 

III. Free Flight versus Miles-In-Trail 

ANALYSIS 

The parts of airspace where the highest aircraft den- 
sities occur are the terminal areas in the vicinity of 
airports. Therefore, these constitute an ideal setting for 
evaluating the ability for traffic to undergo graceful 
degradation. This choice is also motivated by current 
vistas on future operations in terminal areas, which 
have been named "Super-Density operations" (NextGen) 
and "High Complexity Terminal operations" (SESAR). 
Both consist of increasing the airspace capacity around 
busy airports. A solution proposed in SESAR [3] is 
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the multiple merge points arrival operation shown in 
Figure [5]). One way to interpret this solution is to 
assimilate the new mode of operation to a "Free-Flight" 
scenario, whereby the route structure in the terminal area 
is relaxed and the only constraint on incoming aircraft is 
to meet a specific arrival time at the merge point. This 
scenario contrasts sharply with current airport arrival 
practices, where high-density arrival flows of aircraft are 
organized tens or even hundred of miles prior to landing, 
by lining up aircraft along arrival routes and spacing 
them appropriately. Such operations are often denoted 
Miles-In-Trail (MIT) operations. 

Therefore we believe it is interesting and worthwhile 
to compare the ability for both operations, denoted 
Free-Flight (FF) and miles-in trail (MIT) to undergo 
graceful degradation of the navigation system. For that 
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Fig. 5: Arrival Routes, Multiple Merge Points [3] 

purpose, we consider a simplified scenario that involve 8 
aircraft merging to a common point of coordinates (0, 0). 
We assume that all aircraft are Time Based Separated 
(TBS): Each aircraft is given an arrival time so as to 
meet a precise and regular arrival rate at the merge 
point. Assuming all aircraft fly at the same speed of 
200kt, the aircraft must therefore be initially located 
on regularly spaced circles centered at the merge point. 
The inter-aircraft spacings are designed to emulate fu- 
ture Instrument Meteorological Conditions (IMC) arrival 
operations on closely spaced parallel runways, such as 
San Francisco Airport: As observed in [19], the average 
interarrival time for each runway is slightly less than 2 
minutes. This translates into a 3Nm average separation 
between aircraft when they fly at 200/ct and the two 
runways are in use. This separation also turns out to be 
a very conservative estimate of separation requirements 
for satellite-based navigation systems [15], leading us 
to an initial circle of avoidance of radius ro = 1.5NM 
as proposed by ICAO for ADS-B[20]. The final radius 



of avoidance was chosen to be r/ = 2.5NM to reflect 
the surveillance degradation that would occur, should 
a GPS -based surveillance fail and backup radar-based 
technology had to be used. The rate of growth reflects a 
heading uncertainty AO = 5°. Hence, r = 0.29NM/min. 
The transition time between ro and r/ is T = 3.44min. 

The goal of this study is to evaluate the impact of 
changing arrival operations from Mile-In-Trail towards 
Free Flight. For that purpose, we consider an "arrival 
cone" whose vertex is at the merge point. When the 
cone's angular width is zero or takes small values, it cor- 
responds to highly structured Miles-In-Trail operations. 
When the cone's angular width is large, it corresponds 
to less structured, Free-Flight-like operations. 

The remainder of our study consists of understanding 
the impact of the cone angular width and the aircraft ini- 
tial separations on traffic degradation, should a surveil- 
lance system failure occur. The cone angular width was 
varied from 10° to 60°. The initial aircraft separation, 
that is, the distance between two consecutive circles, was 
chosen to be 3.5NM. 1650 cases with different arrival 
angles have been simulated. The following procedure 
has been used to generate the cases: Since we know the 
distance of each aircraft to the merging point (fixed sep- 
aration distance), the aircraft initial heading was picked 
at random, using a uniform probability distribution in 
the allowed interval (±5°, ±10°, . . .). Figure [6] presents 
two configurations: MIT and FF. The circles represent 
the avoidance circles (red = FF, black = MIT) and have 
initial radius 1.5NM and are centered on the aircraft. 
The blue line shows aircraft's heading. Aircraft are 
represented by a small circle for the MIT configuration 
and asterisks for FF configuration. The allowed arrival 
cone for the FF configuration is depicted in light blue. 



Free Flight us Miles In Trail arrival configuration, 
Maximum arrlyal angle = 30 deg 
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Fig. 6: Free Flight and Miles-In-Trail arrival configurations 

To analyze the impact of a surveillance system degra- 
dation, these traffic configurations have been used as 
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initial condition for the conflict resolution algorithm 
under uncertainties developed in appendix. Let S be the 
index set of all generated cases. The severity of the 
traffic management degradation on the traffic situation 
s e S was evaluated by measuring the average deviation 
rris required for each aircraft, denoting Oiso the initial 
heading of aircraft i and Oi its heading after resolution 
in this situation. 



yiso\ 



(2) 



where n is the number of aircraft. All the cases were then 
sorted by absolute value of the maximum aircraft arrival 
angle and grouped in parameter increments of 2.5°. 

= {s e S such that m8ix{0iso} G [0, 5), z = 1 . . . n}, 

i 

Gk = {s e S such that maxj^^go} ^ [/c — 1, /c), . . . 

i 

i = l...n},k = 7.5, 10, 12. 5,..., 30. 

(3) 

Figure [7] presents the results of the analysis. The 
maximum deviation experienced within each group 
was plotted as a function of the corresponding maximum 
aircraft arrival angle. 
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Fig. 7: Evolution of the worst deviation required. 

Although the figure suffers from sampling irregulari- 
ties, the following general trend may be observed: As the 
arrival cone increases, the aircraft deviations required to 
ensure a conflict free configuration increases 33%. For 
an arrival angle less than 5°, the maximum deviation 
required is 10.6° per aircraft, while it is 14.2° for a 
maximum arrival angle less than 30°. Figures [8] and |9] 
show the avoidance maneuvers for the worst cases of G5 
and G30 with 3.5NM initial separation. Figure [8(a)] and 

0. Aircraft are at 



9(a)| present the configuration at t 
the postion where the avoidance maneuver is calculated. 
The trajectories of t < are represented and the line 



pointing out of the aircraft represent the new aircraft's 
heading. 

Free Flight or Miles-In-Trail do not appear to be sig- 
nificantly different from the stand point of surveillance 
degradation. However, these conclusions were reached 
using computer-based conflict management which may 
differ from human-based conflict management. 



Collision avoidance process under uncertainties 

t = Omin 
V - 200kt 
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(a) t = Omin 



Collision avoidance process under uncertainties 

t = 3min 
V = 200kt 
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(b) t = 3mm 

Fig. 8: Avoidance maneuvers for the worst case of G5 

IV. Conclusion 

This paper has outlined the principle of graceful 
degradation of air traffic operations in the face of Com- 
munication, Navigation or Surveillance system failures. 
Following a generic description of graceful degrada- 
tion requirements and interpreting it in the context of 
safety, we have introduced a specific problem of graceful 
degradation that examines the impact of failures of 
the surveillance system on airborne traffic separation 
assurance. Considering current Miles-In-Trail and future 
Free-Flight approach scenarios, we have shown that free- 
flight-like airport approaches do not degrade significantly 
more than current Miles-In-Trail scenarios when facing 
failures of the surveillance system. During the process of 
this study, we have developed a new conflict resolution 
tool that applies to the transient conditions encountered 
during failures of the surveillance system. 
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Collision avoidance process under uncertainties 

t = Omin 
V = 200kt 
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(a) t = Omin 



Collision avoidance process under uncertainties 
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(b) t = 3mm 

Fig. 9: Avoidance maneuvers for the worst case of G30 



aircraft are given by: 



[Vi cos Oi — Vj cos Oj , Vi sin Oi — Vj sin Oj]^ ^ 



(A-4) 
(A-5) 



~ V {Vicosdi— Vj COS 0j)^+(yi sin 0i—Vj sin Oj)"^, 

(A-6) 



(A-7) 

See also Figure |A-1[ Let us define some useful param- 
eters for the avoidance problem. Let Oij be the angle 
between the relative velocity Vij and the x-axis, uij be 
the angle between the connector of the aircraft and the x- 
axis. Finally, let 7^^ be the angle between the connector 
of the aircraft and a line starting from aircraft aci and 
tangent to a circle of radius 2r and centered at aircraft 
acj. We have: 



arctan 



Vij 



arctan 



Uij = arctan 



Vi sin Oi — Vj sin Oj 
Vi cos Oi — Vj cos Oj 
Vj - Vi 



2r 

a7 



Xi 



(A-8) 
(A-9) 
(A-10) 
(A-11) 



Appendix 

An algorithm for conflict resolution under 
uncertainties 

The following appendix presents the algorithm used 
to solve the problem of conflict resolution when several 
aircraft are present. We decided to formulate the problem 
as a Mixed Integer Linear Program (MILP) as it is an 
efficient way to solve optimization problems. A typical 
MILP looks like: 

min fix + /Jz (A-1) 

subject to Aix + A2Z < b (A-2) 

(A-3) 

where /i G M^,/2 G R^, x G M^,z G {0,1}^. Ai G 
R^x^, A2 G M^><^, 6 G R^+^. In what follows we wifl 
focus our attention on developing a MILP model for the 
conflict resolution problem of interest in this paper. 

We consider a set of n aircraft in a planar space. 
Each aircraft ac^, z = 1, n is defined by its position 
{xi^yi), its heading Oi and its speed Vi. 

The relative velocity Vij and speed Vij of aircraft i 
with respect to aircraft j, and the distance Dij between 



' y 
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Fig. A-1: Problem configuration 



A. Problem structure 

We propose to solve the conflict resolution problem 
arising in this paper using a single heading change. The 
originality of our problem lies with the fact that the 
allowable miss distance between the two aircraft is time- 
dependent. Namely, at time t = 0, the minimum miss 
distance is 2ro. For < t < T, the minimum miss 
distance grows from 2ro to 2r/. T is given by 

T=ll^^ (A-12) 

r 
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where r is the growing rate of the circle of avoidance. 
For t >T, the miss distance is constant and equal to 2r/ . 
Figure A-2 illustrates the conflict avoidance constraint in 
a relative frame of reference. For no conflict to occur, 
the circle C of radius 2ro and centered on aircraft acj 
must not intersect the area enclosed by the contour C2. 
This contour C2 can be seen to be the union of the half 
line PI, the circular segment P3 and the line segment 
P2 and their symmetric images across the line passing 
though aci and parallel to the velocity Vij. 



where 




Fig. A-2: Avoidance constraints 

For the purpose of linearization, we approximate the 
countour C2 by means of line segments, not to be 
intersected by the circle C. The first, obvious linear 
approximation is to ask that the circle C not intersect 



either the gray stripe in figure |A-2| or the hatched cone 

whose vertex is aCi. 

• Asking that the circle C not intersect the gray stripe 
is a classical conflict avoidance problem that was 
developed and solved by Pallottino in [16]. This 
problem deals for time t > T, when enough time 
has elapsed for the two radii of avoidance to be 
equal to r/. The avoidance problem presented in 
figure |A-2| consists of finding a change in heading 
for aircraft i and j such that the line parallel to 
Vij and tangent to the circle of radius 2(r/ — ro) 
centered on the relative position of aircraft i to 
aircraft j at T, does not intersect the circle of radius 
2ro centered on acj . This problem is equivalent to 
the line directed along Vij and passing by aircraft i 
does not intersect a circle of radius 2r/ and centered 
on aCj. The avoidance constraints are then: 



or 



>7ii 



(A-13) 



arcsm 



2r/ 



(A-14) 



Asking that the circle C not intersect the hatched 
cone can be detailed as follows, referring back to 
figure |A-2| The angular width 2aij of the cone 



depends on the relative velocity of the aircraft: 



sm aj 



(A-15) 



If Ti + Tj > Vij , the sum of the radii of the 
avoidance circles increases faster than the aircraft 
go away from each other. Whatever the relative 
velocity, the circles are bound to intersect each 
other. Hence, the cone of avoidance is the entire 
plan: as arcsina^j is not defined, we set aij = tt. 
If Ti + Tj = Vij , the increase rate of the circle of 
avoidance is the same as the relative speed. Hence, 
the avoidance cone is a half plane perpendicular to 
the relative velocity, aij = | . The distance between 
the circles of avoidance will remain the same. The 




Fig. A-3: Configuration in the relative frame of reference: 
cone avoidance 



condition of avoidance between two aircraft is given 
by a condition on angles, for — | < ujij < | : 



or 



> % 



' ^ij H~ O-ij ^ '^ij 



where 



arcsm ■ 



2ro 
Di, 



(A-16) 



(A-17) 



< 



7ij 



Figure |A-3] presents those avoidance constraints. To 
avoid any singularity due to angles around ±7r, we 
ensure that — | < uJij < f . To do so, aircraft are 
ordered in function of their position (x^, yi) so that 
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we get: xi < X2 < . . . < Xn and if Xi 
Vi < Vi+i- 

The description of the avoidance constraints could be 
left at that point. However, the developed constraints 
are somewhat conservative. For example, as shown in 
figure A-4 the circle C may intersect the cone and 
the gray stripe without intersecting C2. To improve the 
solution, we may introduce a new constraint. Ideally, we 
would like to introduce the tangent (£1) to C2 at point 
A. In the relative frame of reference, li has a slope 
Oij — i\ not intersecting C2 is equivalent to ^3 not 
intersecting the circle centered on aircraft j and of radius 
(2ro + l^^l). To formulate the constraint, we need the 
distance \AD\, between points A and D. This distance 
is 2(r/-ro)- 
function of 



VijT sin This distance is a non linear 



and Oj as Vij 



and a,, are non linear with 



respect to Oi and Oj . This function depends on too many 
parameters to be linearized easily. Nevertheless, we can 
approximate this constraint by using a line £2 • the line of 
slope 6ij — ^ passing through a point between A and 
B. For that, we need to find a majorant to \DA\. The 
following geometrical development gives this majorant: 
D is the middle of EB and A e [DB]. 




Fig. A-4: Geometry of the curved-part constraint (P3) 



ED 



> 



EB 
EA 



(A-18) 

(A-19) 
(A-20) 



Hence, we get 



or 



>% 



<-7- 



(A-23) 



where 7* is given by 



7r 



arcsm 



rp + Vf 



(A-24) 



As visible on figure A-4 this constraint improves the 
solution by allowing some solutions where the circle C 
was intersecting the first two constraints. 

B. Optimization of the conflict resolution 

In the previous section, we have presented constraints 
that should be satisfied by the aircraft headings to avoid 
a conflict. These constraints may be incorporated in an 
optimal conflict resolution scheme. Denoting the initial 
heading Oio of the aircraft i and Oi its heading after 
resolution, the problem is to compute: 

minJ(^i,^2,...^n) =min ^ \0i - Oo^l (A-25) 



= l...n 



subject to 
For all aircraft i 
For all aircraft j 



l...n- 1, 



or 



or 



and 



and 



and 



- (Jij > 7ij 
UJij <C 7ij 

■ UJij - aij > jij 

^ij ~\~ (^ij ^ 7* J 



(A-26) 



where 7^^, 7^^ and 7^^, are given by equations 



A-17| and |A-24| respectively. 



A- 14 



C. Identical speeds case 

For the sake of computing simplicity, we assume 
all aircraft share the same speed V. This assumption 
This leads to the constraint of the line of slope ^ not simplifies the formulae for Oij and aij and allows us to 

obtain piecewise linear approximations. 



DA = EA- ED 
<rf-ro. 



intersecting the circle of radius 2ro 



2 



(A-21) 
(A-22) 

otij_ 
2 

ro + r/: 
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1) Expression of the angle of the relative velocity: Oij: 
Using the assumption of identical speed, the angle be- 
tween the relative velocity and the x-axis, the expression 



of Oij given by equation A-9 can be simplified : 



iij = arctan -— 

cos 



sm( 



arctan 



sm(- 



cos Oj 

^)cos(^) 



(A-27) 



- sin( ' 2 



Oij is a function of Oi 



Oj and Oi 



2 ) 

. It can be shown 



that Oij is a piecewise affine function of Oi-\-Oj and Oi—Oj 
of the form Oij = ruijiOi + Oj) -\-pij. The value of rriij 
if always ^ and the values taken by Pij are summarized 
in table lA^ 

We can determine the value of Pij using 
boolean variables. Let bCaseDif fPoSij, 
bCaseSumlnfmPiij, bCaseSumSupPiij, bCaselij 
and bCase^ij be boolean variables such that: 



Determination of the sign of Oi — Oj : 

bCaseDif fPoSij = 1 

jOi- Oj - MbCaseDiffPosij < 0, 

1 -Oi + Oj - M(l - bCaseDif fPosij) < 0. 



(A-36) 

Determination of the boolean bCaseSumlnfmPiij if 
Oi + Oj < -tt: 

bCaseSumlnfmPiij = 1 

jOi^Oj ^TT - M(l - bCaseSumlnfmPiij) < 0, 
1 — — Oj — TT — MbCaseSumlnfmPiij < 0. 



(A-37) 



bCaseDif fPoSij = 1 <^=4> 
bCaseSumlnfmPiij = 1 < 

bCaseSumSupPiij = 1 tt < 



>0 
-27r < I 



(A-28) 
(A-29) 
(A-30) 



bCaselij 



1 



bCaseDif fPoSij = 
and 

bCaseSumlnfmPiij - 



bCaselij 



Determination if Oi -\- Oj > tt: 



bCaseSumlnfmPiij = 1 

'-6>i - 6>^- + TT - M(l - bCaseSumSupPiij) < 0, 
6>i + 6>^- - TT - MbCaseSumSupPiij < 0. 



= 1 

(A-31) Determination of the boolean bCaseli 



(A-38) 



bCaseDif fPoSij = 1 
and 

bCaseSumSupPiij = 1 

(A-32) 
(A-33) 

Those 3 boolean variables yield the following expres- 
sion for Pij and hence Oij : 

Pij={bCaseSumPoSij — ^)7r-\-27r {bCaselij —bCaselij ) , 

(A-34) 



{bCaseDif fPoSij — ^)7r + . . . 
27r{bCaselij - bCaselij), (A-35) 



which is linear in Oi and Oj and in the boolean variables. 

2) Constraints formulation for Oij: The following 
formulation uses the big-M method. M is a large 
number such that if multiplied by a boolean set to 1, 
the constraint is always satisfied, whatever the value of 
the other variables. This enables us to select between 
constraints and use or relationship between constraints. 
This is a standard procedure described [21]. 



bCaselij = 1 



' — 1.5 + bCaseDif fPoSij — . . . 

bCaseSumlnfmPiij + 2bCaselij < 0, 
-0.5 - 2bCaseDiffPosij . . . 
-^bCaseSumlnfmPiij — bCaselij < 0, . 



(A-39) 



Determination of the boolean bCase4:i 



bCaseAij = 1 



1.5 — bCaseDif fPoSij — bCaseSumSupPiij . . . 

-2(1 - bCase4ij) < 0, 
-1.5 + bCaseDif fPoSij + bCaseSumSupPiij . . . 



-bCaselij < 0. 



(A-40) 
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3) Cone angular width 2aij in the relative frame of 
reference: This section presents the formulas to deter- 
mine the cone angular width 2aij when aircraft share 
an identical speed. The assumption leads to = r, z = 
1 . . . n and 

2r 

= arcsin — , 

^ V^F^ (cos Oi - cos Oj ) 2 + V2 (sin 6>i - sin Oj ) ^ 

r 



V\smC-^)\ 



— arcsm 



tan AO 

|sm(^-^ 



(A-41) 

The half cone angular width aij is given by equation 
and it is a non linear function of Oj — On. This 



(A-41 



function is symmetric about Oi — Oj = and consists of 
two quasi convex components, separated at Oi — Oj =0, 



as shown in Figure |A-5| The epigraph of each of these 
quasi convex components can be approximated by the 
intersection of linear constraints defined by their slopes 
a/e and intercepts bk- Using the big-M method allows 
us to account for the presence of two disconnected 
components, and this linearization leads to: 

g function ofH^-B^ -.S.^^ =a1ani;tan[AB)/lsin(B^-9^)|i 



- a = a1an(taruiB/|sinfe^-e^)|) 

- Linearization 



Epigrah of a bounded by 




Fig. A-5: aij function of Oi — Oj and the linearization used 



The avoidance constraints are now given by: 



2 V2 

+7ij — MhC aselneqP osij < 



bCasePluSij)TT + Uij 



OLi 



and 

^'^^^ + ~ bCasePluSij)7r — ujij + 
+7^j — M(l — bC aselneqPoSij) < 



(A-43) 

with bCaselneqPoSij a binary variable used to trans- 
form the or between the constraints in an and relation- 
ship. 

4) Mixed constraints for conflict avoidance: The 



conflict avoidance constraints given by equation |A-26 
can be handled in a linear programming framework by 
using the big-M method, leading to the following mixed 
constraints: 



(i — bCasePluSij)7i + uoij + 



2 V2 

—MbCaselneqPos 
^'^^^ + (| ~ bCasePluSij)Ti 
— M(l — bCaselneqPoSij) 



Mblij < 



Mblij < 



bCasePluSij)iT - 



2 V2 

—MbCaselneqPos 
^-^^{\-bCasePluSij)iT 

— M(l — bCaselneqPoSij) 
_QjA^ — — bCasePlus. 



Mb2ij < 



- Mb2ij < 



^2 ^^^^^^ V^^^J 

—MbCaselneqPoSij 

+ - bCasePluSij)TT 
—Mil — bCaselneqPoSij) 



ijrf 



MbSij < 



+ 7*- 



Mb3ij < 



bl. 



b2i 



b3^ 



(A-44) 



ai{Oi - I 
a2{0i - I 

ai{Oi - i 

- ai{Oi 

- Ci2{0i 



9j)^b, 

9j)^b2 



MbCaseAlphaPoSij < ai 
MbCaseAlphaPoSij < ai 



-\- bl — MbCaseAlphaPoSij < a. 
9j)^bi-M{l 
9j)^b2-M{l 



bCaseAlphaPoSij) < aij 
bCaseAlphaPoSij) < aij 



with blij^b2ij and bSij binary variables. 

The global algorithm consists on minimizing expres- 
sion [A^25] subject to all the constraints previously devel- 



oped. We wrote the constraints in an AMPL format and 
solved using CPLEX. MATLAB was used to generate 
the 1650 cases and was also used for the post-processing. 
The computing time to solve an 8 aircraft configuration 
ranged from less than a second to dozen of seconds on 
a 4-processor, Pentium class computer. 



ai{0,-Oj)^bi-M{l 



bCaseAlphaPoSij) < aij 
(A-42) 



with bCaseAlphaPoSij a binary variable used to trans- 
form the or between the constraints in an and relation- 
ship. 
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Issue 


R-6 


In addition, backup 
functions are 
distributed throughout 
the system, and 
there are layers of 
protection to allow for 
graceful degradation of 
services in the event of 
automation failures. 


Develop guidance for what 
flexibility is allowed in the im- 
plementation of airborne sepa- 
ration management algorithms 
to ensure operationally con- 
sistent results, understanding 
whether variations in algo- 
rithms can result in major 
impacts on overall operations. 


R-9 


C-ATM is the means 
by which flight 
operator objectives are 
balanced with overall 
NAS performance 
objectives and 
accomplishes many of 
the objectives for CM, 
FCM, and TM. 


Super Density operations will 
result in many aircraft in 
close proximity. Consequently 
an aircraft deviating from its 
assigned trajectory is much 
more likely to cause an im- 
mediate conflict with another 
aircraft, and safe avoidance 
maneuvers may be limited 
or unavailable. How can su- 
per density operations be con- 
ducted safely, especially in the 
presence of severe weather? 


R-10 


C-ATM is the means 
by which flight 
operator objectives are 
balanced with overall 
NAS performance 
objectives and 
accomplishes many of 
the objectives for CM, 
FCM, and TM. 


Develop requirements for a 
collision avoidance system 
that is compatible with 
NextGen tactical separation? 

Unless mandated otherwise, 
some aircraft will likely 
be equipped with legacy 
TCAS/ACAS systems which 
may generate unwanted alerts 
during normal operations. How 
should this be accounted for? 


R-28 


In all, these new kinds 
of flight operations 
dramatically improve 
en route productivity 
and capacity and are 
essential to achieving 
NextGen. 


If the automation fails, 
what is the backup 
plan in terms of peo- 
ple/procedures/automation? 


R-44 


As illustrated in 
Figure ^ superdensity 
corridors handle 
arriving and departing 
traffic, while much 
nearby airspace 
remains available to 
other traffic. 


We do not prove today's ATC 
system is safe, but rely on 
historical data. NextGen will 
be required to both be safe 
and to demonstrate it is safe. 
How will safety be designed 
into all aspects of NextGen 
and then proven? 


P-1 


In addition, backup 
functions are 
distributed throughout 
the system, and 
there are layers of 
protection to allow for 
graceful degradation of 
services in the event of 
automation failures. 


Develop policies concerning li- 
ability for delegated separa- 
tion and self-separation oper- 
ations. 



TABLE 2: NextGen research and policies issues (Part 2) 



Case 1 


0^ -Oj <0 and -27r < Oi + Oj < -tt 


Pij — 2 


Case 2 


Oi - Oj <0 and -tt < Oi + Oj < 2tt 


=-f 


Case 3 


Oi - Oj >0 and -27r KOi+Oj <7t 




Case 4 


Oi - Oj >0 and tt < Oi + Oj < 27t 


Pij = 



TABLE A-1: Intercept coefficient of 0, 



